Overview

Privilege escalation is the process of expanding access from an initial foothold to a level of control that supports the operation's objectives. It includes both local privilege escalation on a single host and domain-level escalation.

Strategic context

Initial access rarely provides the level of privilege needed to accomplish all engagement objectives. The foothold may be a low-privileged user, a standard domain account, or a service account with limited permissions. Privilege escalation bridges the gap between where access begins and where we need it to be.

Effective privilege escalation is informed by the enumeration conducted during internal reconnaissance and Active Directory enumeration. Blind escalation attempts generate noise and risk detection. Targeted escalation using a specific technique based on a known misconfiguration is far quieter and more reliable.

For security leaders, privilege escalation reveals the consequences of misconfiguration, excessive permissions, and deferred patching. Most escalation techniques exploit conditions that are preventable through disciplined configuration management, least privilege enforcement, and regular testing.

Categories of privilege escalation

This manual organizes privilege escalation into four categories.

Active Directory attacks

AD attacks exploit domain-level misconfigurations, protocol weaknesses, and trust relationships to escalate from a standard domain user to privileged access. These attacks target the identity infrastructure itself.

Credential reuse

Credentials discovered during the engagement, through enumeration, dumping, or cracking, are tested against additional systems and services. Credential reuse is one of the simplest and most effective escalation techniques because it exploits human behavior rather than technical vulnerabilities.

Linux local privilege escalation

Local escalation on Linux systems exploits misconfigurations in file permissions, sudo policies, scheduled tasks, service configurations, and kernel vulnerabilities to move from a standard user to root.

Windows local privilege escalation

Local escalation on Windows systems exploits misconfigurations in services, registry settings, scheduled tasks, token handling, and missing patches to move from a standard user to SYSTEM or Administrator.

Persistence

Persistence is a consideration both before and after privilege escalation, particularly in hardened environments where you may spend considerable time operating from your foothold.

See Actions on Objective: Peristence.

Common mistakes

• Attempting escalation before completing internal reconnaissance

• Ignoring misconfigurations

• Not testing discovered credentials against other systems

• Using noisy escalation techniques in monitored environments

Operator notes

• Escalation should be informed by reconnaissance, not guided by automated tools

• The simplest path is usually the best

• Consider the detection profile of each escalation technique

• Document the escalation path completely. Clients need to understand not just that escalation occurred, but exactly how

• If an exploit is likely to crash a service or system, inform your client before executing